Use wider types to prevent unsigned overflow diagnostics

The rest of the (covered) codebase is already integer overflow clean.
This is a cherry-pick of an internal change.

TESTED=gtest_shuffle_test goes from fail to pass with -fsanitize=integer